CVE-2026-118559
Low risk· EPSS 1%Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Drupal Commerce Stripe module contains an improper verification of cryptographic signature vulnerability, allowing signature spoofing. This issue affects versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3.
Risk Assessment
An attacker could forge cryptographic signatures, potentially leading to unauthorized payment operations or breach of transaction integrity. Organizations using this module are exposed to financial fraud and loss of trust.
Recommendation
Update the Commerce Stripe module to a version later than 1.4 or 2.2.3, as recommended by the Drupal Security Team. Verify key and signature configuration after the update.
Other vulnerabilities in Drupal Commerce Stripe
See all- CVE-2026-118560Low risk· EPSS 5%
The Commerce Stripe module for Drupal contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 2.0.0 to 2.2.3.
- CVE-2026-118558Low risk· EPSS 1%
The Drupal Commerce Stripe module is vulnerable to Cross-Site Request Forgery (CSRF), which can force unwanted actions on behalf of a logged-in user. This issue affects versions from 2.0.0 to 2.2.3.
Original NVD description (English source)
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS